wormclaude 1.0.171 → 1.0.173

package/dist/commands.js

@@ -273,6 +273,8 @@ function formatFinding(x) {
         return `${sev}${tt('missing security headers', 'eksik güvenlik başlıkları')}: ${(x.missing || []).join(', ')}`;
     if (x.type === 'path')
         return `${sev}${tt('path', 'yol')} ${x.url || ''} → ${x.status || ''}`;
+    if (x.type === 'info')
+        return `${sev}${x.evidence || x.url || 'info'}`;
     if (x.value)
         return `${x.value}`;
     // GENEL: şablon bulguları (ssrf/ssti/lfi/ldap/cmd-injection/nosql/open-redirect/crlf/graphql/cors/exposure…)
@@ -317,7 +319,7 @@ export function summarizeScan(target, findings) {
     if (low.length)
         out.push((L ? `🔵 ${low.length} düşük (minör): ` : `🔵 ${low.length} low (minor): `) + grp(low, false).map((s) => s.replace(/^ {2}• /, '')).join('; '));
     if (info.length)
-        out.push((L ? `⚪ ${info.length} bilgi (korumalı/bilgilendirme): ` : `⚪ ${info.length} info: `) + grp(info, false).map((s) => s.replace(/^ {2}• /, '')).join('; '));
+        out.push((L ? `⚪ ${info.length} bilgi: ` : `⚪ ${info.length} info: `) + info.map((f) => (f.evidence || f.type || '').toString().split(' — ')[0]).slice(0, 5).join(' · '));
     // verdict
     if (high.length)
         out.push(L ? `\n➤ Sonuç: ${high.length} GERÇEK yüksek-risk açık — acil düzeltilmeli. Detaylı rapor için: /report`
@@ -496,6 +498,17 @@ async function fullScanCmd(arg, ctx) {
         all.push(...f);
         ctx.note(`  ${label}: ${f.length} ${tt('finding(s)', 'bulgu')}`);
     }
+    // "Parametreli uç bulunamadı" notlarını TEK mesaja topla (her inject tarayıcı bir tane ekliyor → 12 kopya).
+    const _np = all.filter((f) => f.note === 'no_params');
+    if (_np.length) {
+        for (let i = all.length - 1; i >= 0; i--)
+            if (all[i].note === 'no_params')
+                all.splice(i, 1);
+        if (_np.length >= 2) {
+            all.push({ type: 'info', severity: 'info', url: target, note: 'no_params',
+                evidence: tt(`${_np.length} injection scanners found NO GET parameter to test — target inputs are likely POST forms / behind login (not covered by GET-based scanning; use a parameterized URL or test manually).`, `${_np.length} enjeksiyon tarayıcısı test edecek GET parametresi BULAMADI — hedefin girdileri muhtemelen POST form / login-arkası (GET taraması kapsamı dışı; parametreli URL ver ya da manuel test et).`) });
+        }
+    }
     const order = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
     all.sort((a, b) => (order[a.severity] ?? 9) - (order[b.severity] ?? 9));
     setLastScan(target, all); // /report için sakla

package/dist/theme.js

@@ -16,4 +16,4 @@ export const theme = {
     synType: '#a78bfa', // tip/sınıf adları, sabitler
     synProp: '#e0e0e0', // özellik/anahtar adları
 };
-export const VERSION = '1.0.171';
+export const VERSION = '1.0.173';

package/dist/tools.js

@@ -741,8 +741,8 @@ async function execOne(call, hooks) {
         const _ck = tool + '|' + target.toLowerCase();
         const _cached = _scanCache.get(_ck);
         if (_cached && Date.now() - _cached.t < 120000) {
-            return { ok: true, args, output: _cached.out
-                    + '\n\n[ALREADY-SCANNED] This exact scan just ran — results above. Do NOT scan again. Answer the user from these findings (explain / prioritize / translate / show fixes). Re-scanning is a loop.' };
+            // SADECE kısa DUR notu — bulguları TEKRAR verme (yoksa model onları yeniden yazıp tekrar çağırır).
+            return { ok: false, args, output: `[ALREADY-SCANNED] "${tool} ${target}" already ran — its findings are ALREADY in the conversation above. STOP: do NOT call SecurityScan again. Reply to the user in TEXT now using those findings. Another scan call is a forbidden loop.` };
         }
         try {
             const { runPentest } = await import('./pentest.js');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wormclaude",
-  "version": "1.0.171",
+  "version": "1.0.173",
   "description": "WormClaude CLI - uncensored security+code assistant (ink TUI, Claude-style)",
   "type": "module",
   "bin": {